_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:10.6489686Z'/><EventRecordID>32221</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:10.648</Data><Data Name='ProcessGuid'>{b5ee82db-688a-6962-e93e-000000000800}</Data><Data Name='ProcessId'>5844</Data><Data Name='Image'>C:\Windows\System32\findstr.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Find String (QGREP) Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>FINDSTR.EXE</Data><Data Name='CommandLine'>findstr  /r "LISTENING"</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=7E484985CC835B3892F7445D2692227BA2D2E6F5,MD5=D0A20941751521C0D19BD3EABF34C446,SHA256=940CBEC6750076F2A191CBC8DA96AAE1905F7D9709B48C839BBD52884EFF1A45,IMPHASH=A27641A39DA5A6B0717E06BA00E56B7F</Data><Data Name='ParentProcessGuid'>{b5ee82db-688a-6962-e73e-000000000800}</Data><Data Name='ParentProcessId'>3760</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:10.6468897Z'/><EventRecordID>32220</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1049,technique_name=System Network Connections Discovery</Data><Data Name='UtcTime'>2026-01-10 14:56:10.644</Data><Data Name='ProcessGuid'>{b5ee82db-688a-6962-e83e-000000000800}</Data><Data Name='ProcessId'>1544</Data><Data Name='Image'>C:\Windows\System32\NETSTAT.EXE</Data><Data Name='FileVersion'>10.0.20348.3451 (WinBuild.160101.0800)</Data><Data Name='Description'>TCP/IP Netstat Command</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>netstat.exe</Data><Data Name='CommandLine'>netstat  -nao </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2B36D7C03533E8B3DBDEC15DBB173BCB69DB2239,MD5=BDDFB67C57B9C131E5E2927C587A13ED,SHA256=8AD63014D94CF150B19B3AF2E9C5FF5EC19B7ACAFF49D97AFD3AC4C34B9DF4F8,IMPHASH=0621372A264AC3B58A59C2C28375CA74</Data><Data Name='ParentProcessGuid'>{b5ee82db-688a-6962-e73e-000000000800}</Data><Data Name='ParentProcessId'>3760</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c netstat -nao | findstr /r "LISTENING"</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>

_sourcetype: XmlWinEventLog

sourcetype: XmlWinEventLog


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:10.5177273Z'/><EventRecordID>32212</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:10.516</Data><Data Name='ProcessGuid'>{b5ee82db-688a-6962-e43e-000000000800}</Data><Data Name='ProcessId'>6408</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-688a-6962-e33e-000000000800}</Data><Data Name='ParentProcessId'>1936</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:10.4124597Z'/><EventRecordID>32204</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:10.411</Data><Data Name='ProcessGuid'>{b5ee82db-688a-6962-e03e-000000000800}</Data><Data Name='ProcessId'>6056</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-688a-6962-df3e-000000000800}</Data><Data Name='ParentProcessId'>6828</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:10.3024680Z'/><EventRecordID>32196</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:10.301</Data><Data Name='ProcessGuid'>{b5ee82db-688a-6962-dc3e-000000000800}</Data><Data Name='ProcessId'>7808</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-688a-6962-db3e-000000000800}</Data><Data Name='ParentProcessId'>2028</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:10.1669264Z'/><EventRecordID>32187</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:10.165</Data><Data Name='ProcessGuid'>{b5ee82db-688a-6962-d83e-000000000800}</Data><Data Name='ProcessId'>8040</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-688a-6962-d73e-000000000800}</Data><Data Name='ParentProcessId'>5516</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:10.0618757Z'/><EventRecordID>32179</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:10.060</Data><Data Name='ProcessGuid'>{b5ee82db-688a-6962-d43e-000000000800}</Data><Data Name='ProcessId'>4416</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-688a-6962-d33e-000000000800}</Data><Data Name='ParentProcessId'>2108</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:09.9213006Z'/><EventRecordID>32171</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:09.918</Data><Data Name='ProcessGuid'>{b5ee82db-6889-6962-d03e-000000000800}</Data><Data Name='ProcessId'>6724</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6889-6962-cf3e-000000000800}</Data><Data Name='ParentProcessId'>6316</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:09.7903222Z'/><EventRecordID>32163</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:09.788</Data><Data Name='ProcessGuid'>{b5ee82db-6889-6962-cc3e-000000000800}</Data><Data Name='ProcessId'>3592</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6889-6962-cb3e-000000000800}</Data><Data Name='ParentProcessId'>7192</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:09.6658424Z'/><EventRecordID>32155</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:09.664</Data><Data Name='ProcessGuid'>{b5ee82db-6889-6962-c83e-000000000800}</Data><Data Name='ProcessId'>5168</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6889-6962-c73e-000000000800}</Data><Data Name='ParentProcessId'>2648</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:09.5283414Z'/><EventRecordID>32147</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:09.527</Data><Data Name='ProcessGuid'>{b5ee82db-6889-6962-c43e-000000000800}</Data><Data Name='ProcessId'>3532</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6889-6962-c33e-000000000800}</Data><Data Name='ParentProcessId'>8064</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:09.2774287Z'/><EventRecordID>32138</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:09.276</Data><Data Name='ProcessGuid'>{b5ee82db-6889-6962-c03e-000000000800}</Data><Data Name='ProcessId'>6360</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6889-6962-bf3e-000000000800}</Data><Data Name='ParentProcessId'>6228</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:09.1381766Z'/><EventRecordID>32130</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:09.137</Data><Data Name='ProcessGuid'>{b5ee82db-6889-6962-bc3e-000000000800}</Data><Data Name='ProcessId'>2552</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6889-6962-bb3e-000000000800}</Data><Data Name='ParentProcessId'>1812</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:08.9751838Z'/><EventRecordID>32122</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:08.974</Data><Data Name='ProcessGuid'>{b5ee82db-6888-6962-b83e-000000000800}</Data><Data Name='ProcessId'>7008</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6888-6962-b73e-000000000800}</Data><Data Name='ParentProcessId'>6580</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:08.7886365Z'/><EventRecordID>32114</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:08.786</Data><Data Name='ProcessGuid'>{b5ee82db-6888-6962-b43e-000000000800}</Data><Data Name='ProcessId'>8184</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6888-6962-b33e-000000000800}</Data><Data Name='ParentProcessId'>3636</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:08.6313317Z'/><EventRecordID>32106</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:08.630</Data><Data Name='ProcessGuid'>{b5ee82db-6888-6962-b03e-000000000800}</Data><Data Name='ProcessId'>6120</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6888-6962-af3e-000000000800}</Data><Data Name='ParentProcessId'>7576</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:08.4653544Z'/><EventRecordID>32098</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:08.464</Data><Data Name='ProcessGuid'>{b5ee82db-6888-6962-ac3e-000000000800}</Data><Data Name='ProcessId'>7656</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6888-6962-ab3e-000000000800}</Data><Data Name='ParentProcessId'>7700</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:07.7418452Z'/><EventRecordID>32087</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:07.740</Data><Data Name='ProcessGuid'>{b5ee82db-6887-6962-a83e-000000000800}</Data><Data Name='ProcessId'>8044</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6887-6962-a73e-000000000800}</Data><Data Name='ParentProcessId'>6292</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:07.2880807Z'/><EventRecordID>32079</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1057,technique_name=Process Discovery</Data><Data Name='UtcTime'>2026-01-10 14:56:07.123</Data><Data Name='ProcessGuid'>{b5ee82db-6887-6962-a43e-000000000800}</Data><Data Name='ProcessId'>6312</Data><Data Name='Image'>C:\Windows\System32\tasklist.exe</Data><Data Name='FileVersion'>10.0.20348.1 (WinBuild.160101.0800)</Data><Data Name='Description'>Lists the current running tasks</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>tasklist.exe</Data><Data Name='CommandLine'>tasklist  /nh /fo csv</Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=A440302FCCCB6D181F8DB017265602397E1EB92A,MD5=2B05A9BDFAEAC5743B47A10F3F0A202B,SHA256=31E6A056EB1E722D8EC8C7E152E6A410B12D6055140BC38FFA1CCBD56AD4E623,IMPHASH=FCEA32ABE79C10DFACC88F5335DD89DE</Data><Data Name='ParentProcessGuid'>{b5ee82db-6887-6962-a23e-000000000800}</Data><Data Name='ParentProcessId'>5436</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c tasklist /nh /fo csv</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:05.9723098Z'/><EventRecordID>32018</EventRecordID><Correlation/><Execution ProcessID='3488' ThreadID='3148'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:05.953</Data><Data Name='ProcessGuid'>{b5ee82db-6885-6962-963e-000000000800}</Data><Data Name='ProcessId'>5340</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{b5ee82db-e203-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{b5ee82db-6885-6962-953e-000000000800}</Data><Data Name='ParentProcessId'>7116</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:04.5468925Z'/><EventRecordID>30219</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:04.544</Data><Data Name='ProcessGuid'>{d79348b5-6884-6962-0740-000000000800}</Data><Data Name='ProcessId'>6880</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6884-6962-0640-000000000800}</Data><Data Name='ParentProcessId'>5100</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:04.4145627Z'/><EventRecordID>30211</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:04.412</Data><Data Name='ProcessGuid'>{d79348b5-6884-6962-0340-000000000800}</Data><Data Name='ProcessId'>6972</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6884-6962-0240-000000000800}</Data><Data Name='ParentProcessId'>4588</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:04.2896400Z'/><EventRecordID>30203</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:04.287</Data><Data Name='ProcessGuid'>{d79348b5-6884-6962-ff3f-000000000800}</Data><Data Name='ProcessId'>4828</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6884-6962-fe3f-000000000800}</Data><Data Name='ParentProcessId'>632</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:04.1498237Z'/><EventRecordID>30195</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:04.147</Data><Data Name='ProcessGuid'>{d79348b5-6884-6962-fb3f-000000000800}</Data><Data Name='ProcessId'>4524</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6884-6962-fa3f-000000000800}</Data><Data Name='ParentProcessId'>6176</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:04.0273683Z'/><EventRecordID>30187</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:04.025</Data><Data Name='ProcessGuid'>{d79348b5-6884-6962-f73f-000000000800}</Data><Data Name='ProcessId'>2976</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6884-6962-f63f-000000000800}</Data><Data Name='ParentProcessId'>6916</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:03.9051253Z'/><EventRecordID>30179</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:03.903</Data><Data Name='ProcessGuid'>{d79348b5-6883-6962-f33f-000000000800}</Data><Data Name='ProcessId'>1152</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6883-6962-f23f-000000000800}</Data><Data Name='ParentProcessId'>6240</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:03.7819490Z'/><EventRecordID>30171</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:03.779</Data><Data Name='ProcessGuid'>{d79348b5-6883-6962-ef3f-000000000800}</Data><Data Name='ProcessId'>208</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6883-6962-ee3f-000000000800}</Data><Data Name='ParentProcessId'>692</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:03.6341869Z'/><EventRecordID>30163</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:03.632</Data><Data Name='ProcessGuid'>{d79348b5-6883-6962-eb3f-000000000800}</Data><Data Name='ProcessId'>2652</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6883-6962-ea3f-000000000800}</Data><Data Name='ParentProcessId'>5548</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:03.5195287Z'/><EventRecordID>30155</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:03.517</Data><Data Name='ProcessGuid'>{d79348b5-6883-6962-e73f-000000000800}</Data><Data Name='ProcessId'>5852</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6883-6962-e63f-000000000800}</Data><Data Name='ParentProcessId'>5932</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:03.4074769Z'/><EventRecordID>30147</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:03.405</Data><Data Name='ProcessGuid'>{d79348b5-6883-6962-e33f-000000000800}</Data><Data Name='ProcessId'>6844</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6883-6962-e23f-000000000800}</Data><Data Name='ParentProcessId'>2264</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:03.2974338Z'/><EventRecordID>30139</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:03.295</Data><Data Name='ProcessGuid'>{d79348b5-6883-6962-df3f-000000000800}</Data><Data Name='ProcessId'>2056</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6883-6962-de3f-000000000800}</Data><Data Name='ParentProcessId'>6864</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:03.1861619Z'/><EventRecordID>30131</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:03.184</Data><Data Name='ProcessGuid'>{d79348b5-6883-6962-db3f-000000000800}</Data><Data Name='ProcessId'>5648</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6883-6962-da3f-000000000800}</Data><Data Name='ParentProcessId'>5212</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:03.0567872Z'/><EventRecordID>30123</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:03.054</Data><Data Name='ProcessGuid'>{d79348b5-6883-6962-d73f-000000000800}</Data><Data Name='ProcessId'>6972</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6883-6962-d63f-000000000800}</Data><Data Name='ParentProcessId'>6432</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:02.9351033Z'/><EventRecordID>30115</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:02.932</Data><Data Name='ProcessGuid'>{d79348b5-6882-6962-d33f-000000000800}</Data><Data Name='ProcessId'>4828</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6882-6962-d23f-000000000800}</Data><Data Name='ParentProcessId'>6568</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:02.8221427Z'/><EventRecordID>30107</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:02.820</Data><Data Name='ProcessGuid'>{d79348b5-6882-6962-cf3f-000000000800}</Data><Data Name='ProcessId'>6360</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6882-6962-ce3f-000000000800}</Data><Data Name='ParentProcessId'>6396</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:02.7109815Z'/><EventRecordID>30099</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:02.708</Data><Data Name='ProcessGuid'>{d79348b5-6882-6962-cb3f-000000000800}</Data><Data Name='ProcessId'>6912</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6882-6962-ca3f-000000000800}</Data><Data Name='ParentProcessId'>6300</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:02.5936878Z'/><EventRecordID>30091</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:02.591</Data><Data Name='ProcessGuid'>{d79348b5-6882-6962-c73f-000000000800}</Data><Data Name='ProcessId'>5572</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6882-6962-c63f-000000000800}</Data><Data Name='ParentProcessId'>6528</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:02.4801435Z'/><EventRecordID>30083</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:02.478</Data><Data Name='ProcessGuid'>{d79348b5-6882-6962-c33f-000000000800}</Data><Data Name='ProcessId'>4604</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6882-6962-c23f-000000000800}</Data><Data Name='ParentProcessId'>4692</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:02.3475555Z'/><EventRecordID>30075</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:02.345</Data><Data Name='ProcessGuid'>{d79348b5-6882-6962-bf3f-000000000800}</Data><Data Name='ProcessId'>4224</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6882-6962-be3f-000000000800}</Data><Data Name='ParentProcessId'>6996</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:02.2211329Z'/><EventRecordID>30067</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:02.218</Data><Data Name='ProcessGuid'>{d79348b5-6882-6962-bb3f-000000000800}</Data><Data Name='ProcessId'>1272</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6882-6962-ba3f-000000000800}</Data><Data Name='ParentProcessId'>7056</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:02.0926262Z'/><EventRecordID>30059</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:02.079</Data><Data Name='ProcessGuid'>{d79348b5-6882-6962-b73f-000000000800}</Data><Data Name='ProcessId'>5792</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6882-6962-b63f-000000000800}</Data><Data Name='ParentProcessId'>2580</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:01.9679913Z'/><EventRecordID>30051</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:01.966</Data><Data Name='ProcessGuid'>{d79348b5-6881-6962-b33f-000000000800}</Data><Data Name='ProcessId'>2380</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6881-6962-b23f-000000000800}</Data><Data Name='ParentProcessId'>5940</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:01.8545818Z'/><EventRecordID>30043</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:01.852</Data><Data Name='ProcessGuid'>{d79348b5-6881-6962-af3f-000000000800}</Data><Data Name='ProcessId'>5100</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6881-6962-ae3f-000000000800}</Data><Data Name='ParentProcessId'>5260</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:01.6848759Z'/><EventRecordID>30031</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:01.682</Data><Data Name='ProcessGuid'>{d79348b5-6881-6962-a73f-000000000800}</Data><Data Name='ProcessId'>5836</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6881-6962-a63f-000000000800}</Data><Data Name='ParentProcessId'>4356</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:01.5655362Z'/><EventRecordID>30023</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:01.563</Data><Data Name='ProcessGuid'>{d79348b5-6881-6962-a33f-000000000800}</Data><Data Name='ProcessId'>2032</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6881-6962-a23f-000000000800}</Data><Data Name='ParentProcessId'>2924</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:01.4427818Z'/><EventRecordID>30015</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:01.440</Data><Data Name='ProcessGuid'>{d79348b5-6881-6962-9f3f-000000000800}</Data><Data Name='ProcessId'>6980</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6881-6962-9e3f-000000000800}</Data><Data Name='ParentProcessId'>6248</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>


_raw: <Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>1</EventID><Version>5</Version><Level>4</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2026-01-10T14:56:01.3128877Z'/><EventRecordID>30007</EventRecordID><Correlation/><Execution ProcessID='5908' ThreadID='5696'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>APT-DC-01.allports.local</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>technique_id=T1059,technique_name=Command-Line Interface</Data><Data Name='UtcTime'>2026-01-10 14:56:01.310</Data><Data Name='ProcessGuid'>{d79348b5-6881-6962-9b3f-000000000800}</Data><Data Name='ProcessId'>6920</Data><Data Name='Image'>C:\Windows\System32\wbem\WMIC.exe</Data><Data Name='FileVersion'>10.0.20348.2849 (WinBuild.160101.0800)</Data><Data Name='Description'>WMI Commandline Utility</Data><Data Name='Product'>Microsoft® Windows® Operating System</Data><Data Name='Company'>Microsoft Corporation</Data><Data Name='OriginalFileName'>wmic.exe</Data><Data Name='CommandLine'>wmic  os get LocalDateTime /value </Data><Data Name='CurrentDirectory'>C:\Windows\system32\</Data><Data Name='User'>NT AUTHORITY\SYSTEM</Data><Data Name='LogonGuid'>{d79348b5-e1c4-695e-e703-000000000000}</Data><Data Name='LogonId'>0x3e7</Data><Data Name='TerminalSessionId'>0</Data><Data Name='IntegrityLevel'>System</Data><Data Name='Hashes'>SHA1=2BAF5D9D6A59E27AF6CD8DF52AB2329A4F15D4C0,MD5=2F0740DFF1F664DBCB3C0D4025FD1BE5,SHA256=24BF26349E8947F05AAF6A7FAC826C98084876CC17F369FA9B95861A361D4A97,IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00</Data><Data Name='ParentProcessGuid'>{d79348b5-6881-6962-9a3f-000000000800}</Data><Data Name='ParentProcessId'>1152</Data><Data Name='ParentImage'>C:\Windows\System32\cmd.exe</Data><Data Name='ParentCommandLine'>C:\Windows\system32\cmd.exe /c wmic os get LocalDateTime /value 2>nul</Data><Data Name='ParentUser'>NT AUTHORITY\SYSTEM</Data></EventData></Event>